Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2023 02:38
Static task
static1
Behavioral task
behavioral1
Sample
ATT2023069033662pdf.htm
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ATT2023069033662pdf.htm
Resource
win10v2004-20230220-en
General
-
Target
ATT2023069033662pdf.htm
-
Size
46KB
-
MD5
cc3bb4afafc61e5c8425846839714f18
-
SHA1
d23e10bb85a96b454faff1c2967df546c3f73882
-
SHA256
b5323798899098ae424e96bb4eed9b6908cbff3eab94d5a6e72f3a26948c26f0
-
SHA512
f4fc4fa1a79e685a21cd2eb3fb4728d4992a62d9e371e23520b79fc14908145e73d8bc454c995aff892ddd3724d8f487d516bfaf1a604def975142c3bae21e4e
-
SSDEEP
768:EHYZ8bYdxfJgBwSgMl/G29wNS3pgLkxwbzI7DMkSQy16z/Ih00dLABa77uioQot:E48ixhO3gA37gLewbza7ggjI/lQa7qvF
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133236707178729865" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 2528 chrome.exe 2528 chrome.exe 4516 chrome.exe 4516 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 2528 chrome.exe 2528 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2528 wrote to memory of 1856 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 1856 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3872 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 4228 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 4228 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe PID 2528 wrote to memory of 3908 2528 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\ATT2023069033662pdf.htm1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeaafc9758,0x7ffeaafc9768,0x7ffeaafc97782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1812,i,8128545442983662325,17081217660405022753,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1812,i,8128545442983662325,17081217660405022753,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1812,i,8128545442983662325,17081217660405022753,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3196 --field-trial-handle=1812,i,8128545442983662325,17081217660405022753,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3212 --field-trial-handle=1812,i,8128545442983662325,17081217660405022753,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4992 --field-trial-handle=1812,i,8128545442983662325,17081217660405022753,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=1812,i,8128545442983662325,17081217660405022753,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=1812,i,8128545442983662325,17081217660405022753,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4048 --field-trial-handle=1812,i,8128545442983662325,17081217660405022753,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5da62e7bc08b9a485490b0f8a6d83aff5
SHA10b22f50c2132b2cfda43964029273b5fddd07bf7
SHA2565605c08cd23fe3cd84b52cdaf740f2a212c2b1d578bc2dfa4de72d236f3a45f0
SHA512b4161016357d0542e6a3951e09804e082bb040823cfc916e03c572748c608a1d7edc68e5b37150d28e37618f35969f35a50c3af740195bc33ca143c0721735a2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
539B
MD55c965896d5d1c6a4ee28d7ed878ef04b
SHA182f1066166767fd068bc023e53023fd798e43dcd
SHA256e96d8f6ac88beb5971faa962db91efc425f7f8a2d309735d40596b27d9dd5e3b
SHA512c115050aa3d0ec58bd0443a2a489a8c9ffa2f84858ad4445d99cf45c73a89364026e2b4c8a16fb639cafaa146f4a8ae9f1b659835d07ab2acf165c2cee4887e8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD55dcdd150cae2cca42eeee74c7f35c795
SHA1b0f92ac9e9841a70fd2a3305e66a628ed50e1fa9
SHA25607bc0e66834ac223954f8a7efc6f238c653a271a356d7b2d1fa517028a33d84f
SHA512ff231aae2ebefccc770bf2e7ca4f7f63be9f6fc8e88f19f607a6c7b4a0ac92e3ab061c95d036f608110695b476d9c8d9d12ebfe455a69382703b1eecf999730c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5d4859b3894077977a491949f58c804ac
SHA1fd48da761242737e21992effd72acb34f32a5066
SHA2563e1430ee3d63fca7e9238e9e25c08f1127bf8753cf5705c0ae174f01aef3489c
SHA51215313b57a8f2dbfc58678cddc32c0212959e1973ec9f4b90796523fc56d0464769dd52604586f0b5498a636c3919f03ea7dc8554cbd2d02273d4fd5f5e0db772
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD5f9563ad7daaab03d400b6b773ad68310
SHA1b448a5d3390445823bd73c0118508452cc647f44
SHA25614e79ad7ee67e9cf8feb3a5a3de446c432bb7bb27ebd95e29ae19bc49dfd06e9
SHA512c8d98ab06b5055b09e823c0766d986f92b097b7c4e550f63faf4460944731f6c863d92e25726fd7d83b660e6159d283780afb513d3ef88f6198300bfd4a60131
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
143KB
MD5a7f1722bc78ea18ccd7ab3c86ebb0da8
SHA1dde0876b601153c9aa16fe907d4bec7c8f73b379
SHA2561bf7b6a774367a216e6330eb439aea174f494427e741a0fc7c2ef3a7211ff1af
SHA512a35c71b3d2ee70f6e63f684e35063b7537a81dcc2d817dc298a05403ceb4fa3026599df39cbd9dfccfc22cc0789807e7153a7155092856d15d91fd2f6bc62482
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_2528_BXXXPVXEYWYDIWJAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e